Requirements
You need an administrator computer with macOS 10.11 or later to create and export an institutional recovery key.
- On an administrator computer, open Terminal and execute the following command:
sudo security create-filevaultmaster-keychain /Library/Keychains/FileVaultMaster.keychain
- When prompted, enter a password for the new keychain.
- A keychain (FileVaultMaster.keychain) is created in the following location:
- Unlock the keychain by opening Terminal and executing the following command:
security unlock-keychain /Library/Keychains/FileVaultMaster.keychain
- Open Keychain Access.
- From the menu bar, choose from the File pop-up menu. Then, add the FileVaultMaster.keychain file located in /Library/Keychains/.
- Select FileVaultMaster under the Keychains heading in the sidebar, and then select "All Items" under the Category heading.
- Select the certificate.
Important:
Do not select the private key associated with the certificate.
- From the menu bar, choose from the File pop-up menu. Then, save the recovery key as a .pem file or .cer file.
You will need to upload this file to Jamf Pro when creating the disk encryption configuration.
- Quit Keychain Access.
- Store the keychain (FileVaultMaster.keychain) in a secure location so you can use it to access encrypted data at a later time.
The Recovery Key is saved as a .cer file or a .pem file in the location you specified.